CVE-2026-18844

Name of the Vulnerable Software and Affected Versions Pulsetto Vagus Nerve Stimulator (affected versions not specified)

Description The firmware of the device accepts several undisclosed commands via its Bluetooth Low Energy (BLE) interface. These commands are processed by the device when powered on, despite being sent without authentication or encryption and not being utilized by the companion mobile application. This flaw allows an attacker to override the voltage of the nerve stimulator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.